MAL-2026-16332
Malicious code in feed-widget-helper (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (b5a81a96715497c25b18687ba7b9b42e919c23e700ede8d9944d41d6052d7f83) The package's main entry executes a top-level side effect that reads document.cookie and sends it via fetch to a hardcoded webhook.site collector URL (http://webhook.site/67dba5f1-70f5-413e-9299-2ad886bb77fa) over plain HTTP. Any environment that imports or requires this package leaks its browser cookies to an anonymous third-party listener controlled by the package author. The destination is a webhook.site inbox — an anonymous request-capture service unrelated to any legitimate feed-widget functionality — and the transmission fires unconditionally on load, with no caller opt-in or configuration.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for feed-widget-helper (npm). Pin to a known-safe version or switch to an alternative.